CVE-2013-5618
Critical · 9.8CVSS
9.8
EPSS
10.4%
Published
Dec 11, 2013
CISA due date
—
The record
Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:3 | firefox | 0 | 24.2.0-1.mga3 |
| Mageia:3 | firefox-l10n | 0 | 24.2.0-1.mga3 |
| Mageia:3 | iceape | 0 | 2.24-1.mga3 |
| Mageia:3 | nss | 0 | 3.15.3.1-1.mga3 |
| Mageia:3 | rootcerts | 0 | 20131204.00-1.mga3 |
| Mageia:3 | thunderbird | 0 | 24.2.0-1.mga3 |
| Mageia:3 | thunderbird-l10n | 0 | 24.2.0-1.mga3 |
| Mageia:3 | thunderbird-lightning | 0 | 2.6.4-1.mga3 |
| Mageia:4 | iceape | 0 | 2.24-1.mga4 |
| Red Hat:enterprise_linux:5::client | firefox | 0 | 0:24.2.0-1.el5_10 |
| Red Hat:enterprise_linux:5::client | firefox-debuginfo | 0 | 0:24.2.0-1.el5_10 |
| Red Hat:enterprise_linux:5::client | thunderbird | 0 | 0:24.2.0-2.el5_10 |
| Red Hat:enterprise_linux:5::client | thunderbird-debuginfo | 0 | 0:24.2.0-2.el5_10 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:24.2.0-1.el5_10 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:24.2.0-1.el5_10 |
| Red Hat:enterprise_linux:6::client | firefox | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::client | firefox-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::client | thunderbird | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::client | thunderbird-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::computenode | firefox | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::computenode | firefox-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::server | firefox | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::server | firefox-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::server | thunderbird | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::server | thunderbird-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::workstation | firefox | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::workstation | firefox-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::workstation | thunderbird | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:enterprise_linux:6::workstation | thunderbird-debuginfo | 0 | 0:24.2.0-1.el6_5 |
| Red Hat:rhel_productivity:5 | thunderbird | 0 | 0:24.2.0-2.el5_10 |
| Red Hat:rhel_productivity:5 | thunderbird-debuginfo | 0 | 0:24.2.0-2.el5_10 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 45.5.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2014-1574 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before… Also affects firefox
- CVE-2014-1544 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in… Also affects firefox
- CVE-2014-1533 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before… Also affects firefox
- CVE-2014-1518 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before… Also affects firefox
- CVE-2014-1492 The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking… Also affects firefox
- CVE-2014-1510 The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4… Also affects firefox
- CVE-2014-1511 Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and… Also affects firefox
- CVE-2014-1512 Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla… Also affects firefox